The beaver-ui-list npm package version 35.4.4 includes malicious functionality in its index.js file that loads an auxiliary script (_ext.js). This script determines the operating system and architecture, then downloads a native binary payload from specific Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback to *.dl.wel1.ru. The payload is written to the system's temporary directory under a disguised filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (0755), and it is spawned detached via /bin/sh or cmd. The code uses runtime string assembly to evade static detection and checks environment variables related to telemetry to provide a cover story. This behavior results in arbitrary code execution on any system that installs and loads this package.

This malicious package enables arbitrary code execution on the host system during module load, which can lead to full system compromise, data theft, persistence, or further malware deployment. Because the payload is downloaded and executed without user consent or awareness, any environment that installs this package is at significant risk.

No official patch or remediation is currently documented. Users should immediately avoid installing or using beaver-ui-list version 35.4.4. Remove any existing installations of this package and scan affected systems for the presence of the downloaded payload binaries in temporary directories. Monitor for suspicious processes spawned from temporary locations with disguised names. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.